In what way does a Play Services dependency make them insecure?
I know in-law jokes are fun, but this just makes you sound like an evil arsehat. What in the world did they do to you that you had them do this not once but multiple times? /s
I'm assuming you probably meant to word that to read differently
And the answer to their question is that it depends on your threat model and the amount of risk you are willing to accept. There is no such thing as perfect security or a perfectly validated platform. At some point you have to accept good enough and get on with your life.
Bigger issue is privacy with notifications going through Google, right?
That has never crossed my mind. Do notifications on Android normally go through Google servers? As in could be spied or data mined on?
I don't think all notifications are push notifications, and those that are would be https encrypted between the host and client, so any e2ee message would have to be decrypted on device before showing a notification, google should not have access to this, but of course it comes back to whether you should trust anything software tells you.
It does receive some Firebase messages from Google, but not the type that automatically pops up a notification. Instead these are silent ones that trigger the app to perform a particular action, such as fetching any new Signal messages from Signal's servers.